Overview

overview

7

Static

static

3

2024-06-13...re.exe

windows7-x64

7

2024-06-13...re.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 12:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-13_2c7086e537f4f3a26ecf8b69a7ad22ff_bkransomware.exe
  • Size 1.8MB
  • Sample240613-pp4vrsyemf
  • SHA256 b97863027352ebb8d7ea4a7108198f75685f45e9345cb4a2178c2273fe7ecbe5
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
spywarestealer

Malware Config

Signatures

  • Executes dropped EXE 22 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 35 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-13_2c7086e537f4f3a26ecf8b69a7ad22ff_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-13_2c7086e537f4f3a26ecf8b69a7ad22ff_bkransomware.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2352
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:3216
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    PID:3580
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:1120
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3944
    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:2852
    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1772
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:3500
    • C:\Windows\System32\msdtc.exe
      C:\Windows\System32\msdtc.exe
      1⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Drops file in Windows directory
      PID:3744
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:4592
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:3180
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      PID:5028
    • C:\Windows\system32\locator.exe
      C:\Windows\system32\locator.exe
      1⤵
      • Executes dropped EXE
      PID:4240
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3636
    • C:\Windows\System32\snmptrap.exe
      C:\Windows\System32\snmptrap.exe
      1⤵
      • Executes dropped EXE
      PID:3572
    • C:\Windows\system32\spectrum.exe
      C:\Windows\system32\spectrum.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:3860
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:2360
    • C:\Windows\system32\TieringEngineService.exe
      C:\Windows\system32\TieringEngineService.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2512
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
      1⤵
        PID:4456
      • C:\Windows\system32\AgentService.exe
        C:\Windows\system32\AgentService.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:4380
      • C:\Windows\System32\vds.exe
        C:\Windows\System32\vds.exe
        1⤵
        • Executes dropped EXE
        PID:3368
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3048
      • C:\Windows\system32\wbengine.exe
        "C:\Windows\system32\wbengine.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3660
      • C:\Windows\system32\wbem\WmiApSrv.exe
        C:\Windows\system32\wbem\WmiApSrv.exe
        1⤵
        • Executes dropped EXE
        PID:4636
      • C:\Windows\system32\SearchIndexer.exe
        C:\Windows\system32\SearchIndexer.exe /Embedding
        1⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:556
        • C:\Windows\system32\SearchProtocolHost.exe
          "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
          2⤵
          • Modifies data under HKEY_USERS
          PID:2620
        • C:\Windows\system32\SearchFilterHost.exe
          "C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 896
          2⤵
          • Modifies data under HKEY_USERS
          PID:3456

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            elevation_service.exe
            • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            • Size 2.1MB
            • SHA256 5b98661f32cf1c3d6adc31dd0ea457df0ef55be996f7f67ed49af470857629fb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            maintenanceservice.exe
            • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            • Size 797KB
            • SHA256 954ca84e77ce928080bd9e31eaed0f3df546023aaddfecc1a66033af18883a69
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7z.exe
            • Path C:\Program Files\7-Zip\7z.exe
            • Size 1.1MB
            • SHA256 0eb8e57bf102ec31ab002e55da22d38f638a97d58abdf637f79e9a201109db12
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zFM.exe
            • Path C:\Program Files\7-Zip\7zFM.exe
            • Size 1.5MB
            • SHA256 f37fd2621a4761d1291679a7cc8290f075bce8c48c5f8fe4717dad8d30253ea9
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            7zG.exe
            • Path C:\Program Files\7-Zip\7zG.exe
            • Size 1.2MB
            • SHA256 9ea7e35c7d6869b31fe3bb5740bed37181114980991d7c41accce02f2901e4f2
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Uninstall.exe
            • Path C:\Program Files\7-Zip\Uninstall.exe
            • Size 582KB
            • SHA256 c88b30bcfacb12631c6f72ab495dd7ece984811f07f819aac8d2cc5f91f88bdc
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVShNotify.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
            • Size 840KB
            • SHA256 4545f0884a5ca838fd9636af579d189f5dfa695387edfbc7e5ae5bc894f046b7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            IntegratedOffice.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
            • Size 4.6MB
            • SHA256 e3df45b4c6860f07d4cf9464c4fa69336740a07c5617e780ba5916b16464f758
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            MavInject32.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
            • Size 910KB
            • SHA256 3437c03baf775d0c687c71bb47d7b915ba86c82de0d6e4009ca366f70671510a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OfficeC2RClient.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
            • Size 24.0MB
            • SHA256 ef52da2c379fd4e10bf227d032382bdd7964761c650342282e82c43c3f9dfdac
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appvcleaner.exe
            • Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
            • Size 2.7MB
            • SHA256 961b4c4f4dc2ff545ecbcb6e31efe10243a250510d878a3c576eeef2ee15a0b6
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            LICLUA.EXE
            • Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
            • Size 1.1MB
            • SHA256 1aa3668df55339ad72ca28d20270712110b7eb0f6019938c26e341c8151f4a0d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            OSE.EXE
            • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
            • Size 805KB
            • SHA256 2a9025960389c2c007d2961e6129f975cb73f166d7a88097e77fb2c1e1f8ec27
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSTOInstaller.exe
            • Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
            • Size 656KB
            • SHA256 ab552a8f8dbbe545df3ccd8765a7a0276fa5c7d02ea42711ac36169493a86dc1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrmstp.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\chrmstp.exe
            • Size 5.4MB
            • SHA256 923cc41077630ea99b63ef72c5af440f38cf22490c5c271da3aa01122b391175
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            setup.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
            • Size 5.4MB
            • SHA256 92da15da36d1f6caba44be0f923e5764d681c24927b59c5828660c93d4983fa3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_pwa_launcher.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\chrome_pwa_launcher.exe
            • Size 2.0MB
            • SHA256 f83b4b3a60a32d0c44e50b620f29317d918fd1cb8121613ce4c12285055906d1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            elevation_service.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
            • Size 2.2MB
            • SHA256 5475fc395df3715c53cd1f064e870ef6c6f47b97e00df90038e17a807f2c1c70
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            notification_helper.exe
            • Path C:\Program Files\Google\Chrome\Application\110.0.5481.104\notification_helper.exe
            • Size 1.8MB
            • SHA256 336186a27b307478c4f5768ed4e10c263e04dbb16593a14ac9d925fafe1ed3f0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            chrome_proxy.exe
            • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
            • Size 1.7MB
            • SHA256 82fa545343f70bebd8cb7e1e945c099e6f0c34d1376664b30cb7d057a21878c3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            appletviewer.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
            • Size 581KB
            • SHA256 e522e428a98b62a28c6993607918831914f32b3fbe17c4820f1c3947399d5b7e
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            extcheck.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
            • Size 581KB
            • SHA256 66bd4c2a204f100454d7992522e39953512ed9d6cabe1df6c908648c37b05911
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            idlj.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
            • Size 581KB
            • SHA256 bbe29f48f99a2c6ab630be7ac1ee06583e1c3316eb072f8a2b3fc4bf812baa11
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jabswitch.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
            • Size 601KB
            • SHA256 4d84a84738c9f53cd280c33904a3e60ecc53cfa8b0de32d93f717e8ce5c0f9ef
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jar.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
            • Size 581KB
            • SHA256 d06267f0459b17780b4f55b0af69357ac77146638b35e536dd7e24e7007795a3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            jarsigner.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
            • Size 581KB
            • SHA256 83c3715ef508788102541170b602449f7a80b0ca4a24dc6b1141c30fa788194b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java-rmi.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
            • Size 581KB
            • SHA256 09da33f59e13781d1e2443ef3068e787d508bf6b1eb076b17ccd077abbd5b34d
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            java.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\java.exe
            • Size 841KB
            • SHA256 dde313d36300242ff6f43c64030b4a047a27cba2960c9ef43dec4de8e8491277
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javac.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
            • Size 581KB
            • SHA256 65872b8fdbde682d804428a857a52f9fc3cec5f3cb6aa5aeab0338c955a334b3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javadoc.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
            • Size 581KB
            • SHA256 c0c519fe507ed72ff25f65bb7761684ad70096255d3b0e63aac7051ba43870c1
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javafxpackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
            • Size 717KB
            • SHA256 2ef0a581a2dc642ed0997fc176d66061693579e0d70d7fb425ee231b9887ff79
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javah.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
            • Size 581KB
            • SHA256 67e38d51195d5c3232fbe480cb493c45317ec464321e7993646eabfcf21bed84
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javap.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
            • Size 581KB
            • SHA256 e0ffb4c25f740fb06de9c5d6d6a2215c5cc1cbeb73b26c67fd6c0fb3ec4f70c7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javapackager.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
            • Size 717KB
            • SHA256 285de7f893d37fedbd446b70666df2984d87530b65d5690cb406f166aec30204
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaw.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
            • Size 841KB
            • SHA256 1c57c5e3a261b6b1dfe1bd9ba1ddd7ec81d670f101788bb510e82cf0249963a3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            javaws.exe
            • Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
            • Size 1020KB
            • SHA256 e750f2ff31d98312c1d3a5196ce0d2a5bbbd842e70a4d1734896d013c6bf6c49
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wmpnetwk.exe
            • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
            • Size 1.5MB
            • SHA256 e7c42f9e8c47d9a2202eeacc7c5acf7e2d1c4d80d018c6668ceb8af61a9c773c
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            dotnet.exe
            • Path C:\Program Files\dotnet\dotnet.exe
            • Size 701KB
            • SHA256 155e4355f93345f8dceec2c548ffd88de84a0cdc49d3d83296f87da27b72590b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            perfhost.exe
            • Path C:\Windows\SysWOW64\perfhost.exe
            • Size 588KB
            • SHA256 abc3f4652da87745bbecc773d32da52a349ac3ba5ffc73da4431c1e3fce0dea0
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AgentService.exe
            • Path C:\Windows\System32\AgentService.exe
            • Size 1.7MB
            • SHA256 ee8594a45cc1caf615e3880c4eb99d8e9eeaab36cf59f427504a3191b49a2a3a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            DiagnosticsHub.StandardCollector.Service.exe
            • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
            • Size 659KB
            • SHA256 72303440dcd1bbd99f8e68f3dcbb86f8802399fad5aea9632b80d4be51cc7bcb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            FXSSVC.exe
            • Path C:\Windows\System32\FXSSVC.exe
            • Size 1.2MB
            • SHA256 f88da148020cef4faac7e0701105c7e0792302ec4c76ac0b5e27d8e73b811955
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Locator.exe
            • Path C:\Windows\System32\Locator.exe
            • Size 578KB
            • SHA256 273f6317810ce1b11702b45571131040ff7c925475154789685101c67320115f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            ssh-agent.exe
            • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
            • Size 940KB
            • SHA256 e70745a8fc272e86757150830931e9f802b8411d1f1a9b6f5b6ccb9977d2075a
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            PerceptionSimulationService.exe
            • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
            • Size 671KB
            • SHA256 0c77a08d6195c76a97852f160076587e60defa272bc2e448ba24213cd06a889f
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SearchIndexer.exe
            • Path C:\Windows\System32\SearchIndexer.exe
            • Size 1.4MB
            • SHA256 7c4c3e17c6f613b647847fb87f257a9ba9e47d48fa4a7b0adf2cd68af034e5fb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SensorDataService.exe
            • Path C:\Windows\System32\SensorDataService.exe
            • Size 1.8MB
            • SHA256 f617a1c26398acaa38f1a74c96c7bf289680c100d34309356fe8a9813c909870
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            Spectrum.exe
            • Path C:\Windows\System32\Spectrum.exe
            • Size 1.4MB
            • SHA256 5446e9f1fcc259b97ca317209c66f49b0810a86647bf0aec50b354a51f7df1c7
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            TieringEngineService.exe
            • Path C:\Windows\System32\TieringEngineService.exe
            • Size 885KB
            • SHA256 67791f7a9bfb7234e09798a02030f5566c0a85b5714aa87c33f39e1dd6bd1861
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            VSSVC.exe
            • Path C:\Windows\System32\VSSVC.exe
            • Size 2.0MB
            • SHA256 f79e6fba8b399324a48a20dcd4fc31e41758b2f8402a7ac47ac06756cb019962
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            alg.exe
            • Path C:\Windows\System32\alg.exe
            • Size 661KB
            • SHA256 f21ee2e65c60407e99cc92f536dbf6039762200ce14b7be2371085a6a287effa
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msdtc.exe
            • Path C:\Windows\System32\msdtc.exe
            • Size 712KB
            • SHA256 c57709fa6399bcb54c5858a94d41af79210f04736f2b35c588d246b2412544cb
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            snmptrap.exe
            • Path C:\Windows\System32\snmptrap.exe
            • Size 584KB
            • SHA256 79438675adabe650a8c56f7108b862c0daa44ee16788e0b8b7789477091c152b
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            vds.exe
            • Path C:\Windows\System32\vds.exe
            • Size 1.3MB
            • SHA256 0ec59a386f7c1987c5bca4ee88dbb5abe47bd9566a07c7580c920de9e87b99c3
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            WmiApSrv.exe
            • Path C:\Windows\System32\wbem\WmiApSrv.exe
            • Size 772KB
            • SHA256 e892c2e02451023a82f29375b8c8dc851bd049eabf6439f2a92de18465bf1ac5
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            wbengine.exe
            • Path C:\Windows\System32\wbengine.exe
            • Size 2.1MB
            • SHA256 d917706c31ad74921b21ee64543995cfb12d391eccfbd8794df7bf0a49f46a29
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            AppVClient.exe
            • Path C:\Windows\system32\AppVClient.exe
            • Size 1.3MB
            • SHA256 25690bcc35fae6c7e8ffd58d46be6fe9f69b5d32b2a0e29796db065f3b530343
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            SgrmBroker.exe
            • Path C:\Windows\system32\SgrmBroker.exe
            • Size 877KB
            • SHA256 4027f27d085521f849193cc3da025d220ec49cff95969af345b2923035293021
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            msiexec.exe
            • Path C:\Windows\system32\msiexec.exe
            • Size 635KB
            • SHA256 1214b793cb6367c3314f91e18bd9a83b378d53eafb37788e1aa15b6b78eddadd
            • MD5 SHA1 SHA512 SSDEEP
            Submit Download

            memory/556-542-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/556-268-0x0000000140000000-0x0000000140179000-memory.dmp
            Download

            memory/1772-227-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/1772-65-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/1772-73-0x0000000140000000-0x000000014022B000-memory.dmp
            Download

            memory/1772-71-0x00000000001A0000-0x0000000000200000-memory.dmp
            Download

            memory/2352-7-0x0000000000400000-0x00000000005D9000-memory.dmp
            Download

            memory/2352-8-0x00000000006A0000-0x0000000000707000-memory.dmp
            Download

            memory/2352-0-0x00000000006A0000-0x0000000000707000-memory.dmp
            Download

            memory/2352-99-0x0000000000400000-0x00000000005D9000-memory.dmp
            Download

            memory/2360-188-0x0000000140000000-0x0000000140102000-memory.dmp
            Download

            memory/2512-199-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/2512-535-0x0000000140000000-0x00000001400E2000-memory.dmp
            Download

            memory/2852-226-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/2852-54-0x0000000000C70000-0x0000000000CD0000-memory.dmp
            Download

            memory/2852-63-0x0000000140000000-0x000000014024B000-memory.dmp
            Download

            memory/2852-60-0x0000000000C70000-0x0000000000CD0000-memory.dmp
            Download

            memory/3048-537-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/3048-236-0x0000000140000000-0x00000001401FC000-memory.dmp
            Download

            memory/3180-159-0x0000000140000000-0x00000001400AB000-memory.dmp
            Download

            memory/3216-20-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/3216-21-0x00000000006C0000-0x0000000000720000-memory.dmp
            Download

            memory/3216-12-0x00000000006C0000-0x0000000000720000-memory.dmp
            Download

            memory/3216-173-0x0000000140000000-0x00000001400AA000-memory.dmp
            Download

            memory/3368-223-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/3368-536-0x0000000140000000-0x0000000140147000-memory.dmp
            Download

            memory/3500-88-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/3500-82-0x0000000001AC0000-0x0000000001B20000-memory.dmp
            Download

            memory/3500-86-0x0000000001AC0000-0x0000000001B20000-memory.dmp
            Download

            memory/3500-76-0x0000000001AC0000-0x0000000001B20000-memory.dmp
            Download

            memory/3572-163-0x0000000140000000-0x0000000140096000-memory.dmp
            Download

            memory/3580-26-0x00000000006A0000-0x0000000000700000-memory.dmp
            Download

            memory/3580-35-0x00000000006A0000-0x0000000000700000-memory.dmp
            Download

            memory/3580-30-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/3580-187-0x0000000140000000-0x00000001400A9000-memory.dmp
            Download

            memory/3636-162-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/3636-534-0x0000000140000000-0x00000001401D7000-memory.dmp
            Download

            memory/3660-540-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/3660-239-0x0000000140000000-0x0000000140216000-memory.dmp
            Download

            memory/3744-90-0x0000000000D60000-0x0000000000DC0000-memory.dmp
            Download

            memory/3744-100-0x0000000140000000-0x00000001400B9000-memory.dmp
            Download

            memory/3860-174-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/3860-480-0x0000000140000000-0x0000000140169000-memory.dmp
            Download

            memory/3944-38-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/3944-39-0x0000000000EA0000-0x0000000000F00000-memory.dmp
            Download

            memory/3944-47-0x0000000000EA0000-0x0000000000F00000-memory.dmp
            Download

            memory/3944-51-0x0000000140000000-0x0000000140135000-memory.dmp
            Download

            memory/3944-52-0x0000000000EA0000-0x0000000000F00000-memory.dmp
            Download

            memory/4240-161-0x0000000140000000-0x0000000140095000-memory.dmp
            Download

            memory/4380-212-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4380-201-0x0000000140000000-0x00000001401C0000-memory.dmp
            Download

            memory/4592-158-0x0000000140000000-0x00000001400CF000-memory.dmp
            Download

            memory/4636-541-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/4636-250-0x0000000140000000-0x00000001400C6000-memory.dmp
            Download

            memory/5028-160-0x0000000000400000-0x0000000000497000-memory.dmp
            Download